Handle session lifecycle WebSocket events in Desktop IM state

[DeliciousBuding]

Summary

Desktop exposes Hub session.* WebSocket event constants, but the IM/session client state does not consume those events. After the backend starts emitting the session lifecycle frames tracked in #117, Desktop will still not update contacts/session state unless the receiving side is wired.

Evidence

• app/shared/src/hubEvents.ts and app/desktop/src/api/hubEvents.ts declare session.created, session.dissolved, session.member_joined, session.member_left, and session.info_updated.
• app/desktop/src/hooks/useHubEventStream.ts records lastFrame, but its typed switch only handles message.new, notifications, agent task events, and device presence. It does not derive any session/contact state from session.* frames.
• app/desktop/src/hooks/useIMChat.ts subscribes only to HUB_EVENTS.MESSAGE_NEW; contacts are only changed by local upsertContact / removeContact calls.
• app/desktop/src/views/IMView.tsx renders contacts from useIMChat, so remote group creation, member changes, info updates, or dissolve events cannot update the visible contact/session list in real time.
• app/desktop/src/__tests__/useIMChat.test.ts covers message.new, deduplication, invalid messages, and local contact helpers, but has no regression coverage for any SESSION_* frame.

Impact

Even after the server publishes the declared session lifecycle events, Desktop users can keep stale IM/session lists until a manual REST refresh or local-only mutation happens. This makes group creation, dissolve, membership changes, and group metadata edits look inconsistent across online clients.

Expected behavior

Desktop should either handle the declared session.* frames by updating or invalidating its IM/session state, or explicitly document that the UI is REST-snapshot only and remove the unused realtime constants from the client-facing contract.

Acceptance criteria

• Add a session/contact state path for session.created, session.dissolved, session.member_joined, session.member_left, and session.info_updated, or add a deliberate REST invalidation/refetch strategy for those frames.
• Add hook tests that fire each relevant HUB_EVENTS.SESSION_* frame and assert the visible contact/session state changes or is invalidated.
• Keep existing message.new behavior and deduplication coverage intact.
• Coordinate payload shape with Publish declared session lifecycle WebSocket events #117 so backend and Desktop agree on the same fields.